Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:105107
MIME-Version: 1.0
References: <CAHN63oMjO-7cdnF55Mrj-MxVrq9mvm5=c2M681CuXLkE_Hez_A@mail.gmail.com>
 <CAESVnVpcTTC-77EjLgH-9jwbPgzaR2x_JV+D00SMffWKgU=bkw@mail.gmail.com>
 <CAHN63oP4p-VdK=J3L3vi0GygHawRq5KkCHJEF0tFoQBtSezGiQ@mail.gmail.com>
 <CALKiJKrbcv42cyWYqLfizzNVGc55Z4qEW+X6gfxzoVENSrnZuw@mail.gmail.com>
 <CAHN63oOfR3DD9b_xHLPUh20=jJFQTJH+Qce298k-4vm6X4bdKg@mail.gmail.com>
 <65AF9E1E-DFA6-47AE-952B-9ABEBD9B6038@gmail.com> <CAHN63oMqOgCgh6voyL0sjXQJEnMKQ=NJ+MXQuU0355EG8Apffw@mail.gmail.com>
 <CAHN63oMz1YM5c0V7QLGOJ=1LKEasMuHVxwsdbrxC==5Up6=mMQ@mail.gmail.com>
 <284d1f9f-03d3-1488-77dd-82e18edf9f4c@gmail.com> <CAHN63oOqx9AxU=ofAQceKEQoJqYTuku1AWGa-sw=BLMTMP0Vjw@mail.gmail.com>
 <db94829a-3ffb-998b-08cd-67eb36ea4cc2@gmail.com> <CAFPFaMK5hs3y5VziAnqDjM1sz3-RLvQUgUj0gQYuxshbd_rFGA@mail.gmail.com>
 <CAHN63oOZ6x6PEOJo=u9gVR-5f+87sD7jpwKnw7kKiohf3LSDLg@mail.gmail.com>
 <3144F5D1-1F18-4C42-9B3E-AF1B1E598E47@koalephant.com> <CAESVnVqC+WkyCGp+EOUP_FVpbR2avoyVoRTXBLh5B0TiogykBA@mail.gmail.com>
 <917cb7bc-4abc-4bae-1a5a-b2ba1777fa55@gmail.com> <CAMuFt-5-U0KLnJEOT99-tVWntpT66RjWMWyc_E8b6i3XE42wfg@mail.gmail.com>
 <CALKiJKqF8vgOik8aRc8_dm=Y+o58NqA3PoYvpf7XZcXs55831A@mail.gmail.com>
 <CAMuFt-7mYgBG02SegZTMm2j728DcojSiaG0JRAJVE23ioU0Ryg@mail.gmail.com> <CALKiJKoHX8GHE_rKP7hf0Z=VWu3q54Kn_=aoe3aZ1Cq21T=ZpQ@mail.gmail.com>
In-Reply-To: <CALKiJKoHX8GHE_rKP7hf0Z=VWu3q54Kn_=aoe3aZ1Cq21T=ZpQ@mail.gmail.com>
Date: Fri, 5 Apr 2019 12:41:48 +0100
Message-ID: <CAMuFt-4tN7aqoD0eGojnffZDfMAL1LQhBMBLNEjFBt4MsLv8KQ@mail.gmail.com>
To: Rowan Collins <rowan.collins@gmail.com>
Cc: PHP internals <internals@lists.php.net>
Content-Type: text/plain; charset="UTF-8"
Subject: Re: [PHP-DEV] Question about adding !function_identifier
From: robehickman@gmail.com (Robert Hickman)

In the first case:

function foo(callable $bar): int { return $bar(); }

I think the value of $bar would have to fall into a set of values
known to the programmer, or at least known at some level. The only way
I can currently think of where this would be truly unknown is if it
comes from unfiltered user data, which would be a security issue, due
to allowing arbitrary function calls.

Wordpress does something like this in it's shortcode and
'action/filter' system, The set of valid function calls in that case
would be mostly defined by all calls to 'add_action' and 'do_action'
(and related functions for shortcodes) in the core and installed
plug-ins. It may be unknown in some cases if that is controlled by
user input. As above I doubt that is truly unknown as allowing
untrusted input would be a security issue.

In the second case the iterable has to come from somewhere, so it's
content would be defined by whatever that 'somewhere' is.

Getting back to the original topic, how would 'throws' interact with
exceptions raised by the php interpreter itself?

On Fri, 5 Apr 2019 at 12:12, Rowan Collins <rowan.collins@gmail.com> wrote:
>
> On Fri, 5 Apr 2019 at 11:30, Robert Hickman <robehickman@gmail.com> wrote:
>
> > If a static
> > analyser were programmable, it could parse the SQL query and query the
> > database to find out what keys exist in some_table. Thus it could
> > check for references to non-existing keys.
> >
>
>
> That's an interesting example, but I don't think it generalises as far as
> you think: what would a "programmable analyser" do with an array of HTTP
> headers, or query-string parameters?
>
> However, I wasn't referring to dynamic *data* like this, but rather dynamic
> behaviour in the language itself. A couple of simple examples:
>
> function foo(callable $bar): int { return $bar(); }
> function foo(iterable $bar): int { foreach ( $bar as $baz ) { return $baz;
> } }
>
> In order to analyse those, you need a) the language to offer a richer type
> system (generics, derived types, etc); and b) the programmer to make full
> use of that type system, everywhere.
>
> As soon as you have code that's missing rich type information, or use a
> truly dynamic feature, that whole section of code becomes essentially
> unchecked. That's why Hack is not only adding features for richer
> (statically analysed) type annotations, but also *removing* PHP features
> which don't work nicely with them.
>
> Regards,
> --
> Rowan Collins
> [IMSoP]